Skip to content

Commit da3a0c8

Browse files
Rick-Andersonscottaddieserpent5
authored
CORS 3.1 update (#17345)
* CORS 3.1 update * CORS 3.1 update * work * work * work * work * work * work * work * work * work * work * work * work * work * work * work * work * work * work * work * work * work * work * routing debug NuGet package * routing debug NuGet package * Apply suggestions from code review Co-Authored-By: Scott Addie <10702007+scottaddie@users.noreply.github.com> * Javascript * Apply suggestions from code review Co-Authored-By: Scott Addie <10702007+scottaddie@users.noreply.github.com> * Apply suggestions from code review Co-Authored-By: Scott Addie <10702007+scottaddie@users.noreply.github.com> * work * work * work * Apply suggestions from code review Co-Authored-By: Kirk Larkin <6025110+serpent5@users.noreply.github.com> * react to feedback * react to feedback * react to feedback * react to feedback * react to feedback * react to feedback * react to feedback * react to feedback * Apply suggestions from code review Co-Authored-By: Kirk Larkin <6025110+serpent5@users.noreply.github.com> * react to feedback Co-authored-by: Scott Addie <10702007+scottaddie@users.noreply.github.com> Co-authored-by: Kirk Larkin <6025110+serpent5@users.noreply.github.com>
1 parent c0840da commit da3a0c8

29 files changed

Lines changed: 1435 additions & 163 deletions

‎aspnetcore/security/cors.md‎

Lines changed: 332 additions & 158 deletions
Large diffs are not rendered by default.

‎aspnetcore/security/cors/3.1sample/Cors/WebAPI/.config/dotnet-tools.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"version": 1,
3+
"isRoot": true,
4+
"tools": {
5+
"dotnet-ef": {
6+
"version": "3.1.2",
7+
"commands": [
8+
"dotnet-ef"
9+
]
10+
}
11+
}
12+
}

‎aspnetcore/security/cors/3.1sample/Cors/WebAPI/Controllers/TodoItems1Controller.cs‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
using Microsoft.AspNetCore.Cors;
2+
using Microsoft.AspNetCore.Mvc;
3+
using Microsoft.Docs.Samples;
4+
5+
namespace WebAPI.Controllers
6+
{
7+
#region snippet2
8+
[Route("api/[controller]")]
9+
[ApiController]
10+
public class TodoItems1Controller : ControllerBase
11+
{
12+
// PUT: api/TodoItems1/5
13+
[HttpPut("{id}")]
14+
public IActionResult PutTodoItem(int id)
15+
{
16+
if (id < 1)
17+
{
18+
return Content($"ID = {id}");
19+
}
20+
21+
return ControllerContext.MyDisplayRouteInfo(id);
22+
}
23+
24+
// Delete: api/TodoItems1/5
25+
[HttpDelete("{id}")]
26+
public IActionResult MyDelete(int id) =>
27+
ControllerContext.MyDisplayRouteInfo(id);
28+
29+
// GET: api/TodoItems1
30+
[HttpGet]
31+
public IActionResult GetTodoItems() =>
32+
ControllerContext.MyDisplayRouteInfo();
33+
34+
[EnableCors]
35+
[HttpGet("{action}")]
36+
public IActionResult GetTodoItems2() =>
37+
ControllerContext.MyDisplayRouteInfo();
38+
39+
// Delete: api/TodoItems1/MyDelete2/5
40+
[EnableCors]
41+
[HttpDelete("{action}/{id}")]
42+
public IActionResult MyDelete2(int id) =>
43+
ControllerContext.MyDisplayRouteInfo(id);
44+
}
45+
#endregion
46+
}

‎aspnetcore/security/cors/3.1sample/Cors/WebAPI/Controllers/TodoItems2Controller.cs‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
using Microsoft.AspNetCore.Cors;
2+
using Microsoft.AspNetCore.Mvc;
3+
using Microsoft.Docs.Samples;
4+
5+
// Used in both the MD file and the RP Test.cshtml
6+
7+
namespace WebAPI.Controllers
8+
{
9+
#region snippet2
10+
#region snippet
11+
[Route("api/[controller]")]
12+
[ApiController]
13+
public class TodoItems2Controller : ControllerBase
14+
{
15+
// OPTIONS: api/TodoItems2/5
16+
[HttpOptions("{id}")]
17+
public IActionResult PreflightRoute(int id)
18+
{
19+
return NoContent();
20+
}
21+
22+
// OPTIONS: api/TodoItems2
23+
[HttpOptions]
24+
public IActionResult PreflightRoute()
25+
{
26+
return NoContent();
27+
}
28+
29+
[HttpPut("{id}")]
30+
public IActionResult PutTodoItem(int id)
31+
{
32+
if (id < 1)
33+
{
34+
return BadRequest();
35+
}
36+
37+
return ControllerContext.MyDisplayRouteInfo(id);
38+
}
39+
#endregion
40+
41+
// [EnableCors] // Not needed as OPTIONS path provided
42+
[HttpDelete("{id}")]
43+
public IActionResult MyDelete(int id) =>
44+
ControllerContext.MyDisplayRouteInfo(id);
45+
46+
[EnableCors] // Rquired for this path
47+
[HttpGet]
48+
public IActionResult GetTodoItems() =>
49+
ControllerContext.MyDisplayRouteInfo();
50+
51+
[HttpGet("{action}")]
52+
public IActionResult GetTodoItems2() =>
53+
ControllerContext.MyDisplayRouteInfo();
54+
55+
[EnableCors] // Rquired for this path
56+
[HttpDelete("{action}/{id}")]
57+
public IActionResult MyDelete2(int id) =>
58+
ControllerContext.MyDisplayRouteInfo(id);
59+
}
60+
#endregion
61+
}

‎aspnetcore/security/cors/3.1sample/Cors/WebAPI/Controllers/TodoItemsController.cs‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
using Microsoft.AspNetCore.Cors;
2+
using Microsoft.AspNetCore.Mvc;
3+
4+
namespace WebAPI.Controllers
5+
{
6+
#region snippet
7+
[Route("api/[controller]")]
8+
[ApiController]
9+
public class TodoItemsController : ControllerBase
10+
{
11+
// PUT: api/TodoItems/5
12+
[HttpPut("{id}")]
13+
public ContentResult PutTodoItem(int id)
14+
{
15+
if (id < 1)
16+
{
17+
return Content($"ID = {id}");
18+
}
19+
20+
return Content($"PutTodoItem: ID = {id}");
21+
}
22+
23+
// Delete: api/TodoItems/5
24+
[HttpDelete("{id}")]
25+
public ContentResult MyDelete(int id)
26+
{
27+
return Content($"MyDelete: ID = {id}");
28+
}
29+
#endregion
30+
31+
// GET: api/TodoItems
32+
[HttpGet]
33+
public ContentResult GetTodoItems()
34+
{
35+
return Content("Get TO DO ");
36+
}
37+
}
38+
}

‎aspnetcore/security/cors/3.1sample/Cors/WebAPI/Controllers/ValuesController.cs‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
using Microsoft.AspNetCore.Cors;
2+
using Microsoft.AspNetCore.Mvc;
3+
using Microsoft.Docs.Samples;
4+
5+
namespace WebAPI.Controllers
6+
{
7+
#region snippet
8+
[EnableCors("MyPolicy")]
9+
[Route("api/[controller]")]
10+
[ApiController]
11+
public class ValuesController : ControllerBase
12+
{
13+
// GET api/values
14+
[HttpGet]
15+
public IActionResult Get() =>
16+
ControllerContext.MyDisplayRouteInfo();
17+
18+
// GET api/values/5
19+
[HttpGet("{id}")]
20+
public IActionResult Get(int id) =>
21+
ControllerContext.MyDisplayRouteInfo(id);
22+
23+
// PUT api/values/5
24+
[HttpPut("{id}")]
25+
public IActionResult Put(int id) =>
26+
ControllerContext.MyDisplayRouteInfo(id);
27+
28+
29+
// GET: api/values/GetValues2
30+
[DisableCors]
31+
[HttpGet("{action}")]
32+
public IActionResult GetValues2() =>
33+
ControllerContext.MyDisplayRouteInfo();
34+
35+
}
36+
#endregion
37+
}

‎aspnetcore/security/cors/3.1sample/Cors/WebAPI/Controllers/WidgetController.cs‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
using Microsoft.AspNetCore.Cors;
2+
using Microsoft.AspNetCore.Mvc;
3+
using System.Collections.Generic;
4+
5+
namespace WebAPI.Controllers
6+
{
7+
#region snippet
8+
[Route("api/[controller]")]
9+
[ApiController]
10+
public class WidgetController : ControllerBase
11+
{
12+
// GET api/values
13+
[EnableCors("AnotherPolicy")]
14+
[HttpGet]
15+
public ActionResult<IEnumerable<string>> Get()
16+
{
17+
return new string[] { "green widget", "red widget" };
18+
}
19+
20+
#region snippet2
21+
// GET api/values/5
22+
[EnableCors("Policy1")]
23+
[HttpGet("{id}")]
24+
public ActionResult<string> Get(int id)
25+
{
26+
return id switch
27+
{
28+
1 => "green widget",
29+
2 => "red widget",
30+
_ => NotFound(),
31+
};
32+
}
33+
#endregion
34+
}
35+
#endregion
36+
}

‎aspnetcore/security/cors/3.1sample/Cors/WebAPI/MyGC.cs‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
namespace WebAPI
2+
{
3+
public static class MyGC
4+
{
5+
public const string MyAllowSpecificOrigins = "_myAllowSpecificOrigins";
6+
}
7+
}

‎aspnetcore/security/cors/3.1sample/Cors/WebAPI/Pages/HostPageModel.cs‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
using Microsoft.AspNetCore.Mvc.RazorPages;
2+
using Microsoft.Extensions.Configuration;
3+
4+
namespace WebAPI
5+
{
6+
public class HostPageModel : PageModel
7+
{
8+
public string Host { get; set; }
9+
10+
public void SetHost(IConfiguration configuration, bool changeOrder=false)
11+
{
12+
var h1 = "host1";
13+
var h3 = "host3";
14+
if (changeOrder == true)
15+
{
16+
h1 = "host3";
17+
h3 = "host1";
18+
}
19+
Host = configuration[h1];
20+
var theHost = HttpContext.Request.Host.Value;
21+
if (Host.Contains(theHost))
22+
{
23+
Host = configuration[h3];
24+
}
25+
}
26+
}
27+
}

‎aspnetcore/security/cors/3.1sample/Cors/WebAPI/Pages/Index.cshtml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
@page
2+
@model WebAPI.IndexModel
3+
@inject Microsoft.Extensions.Configuration.IConfiguration Configuration
4+
5+
6+
<div class="text-center">
7+
<h1 class="display-4">CORS Test 1</h1>
8+
@{
9+
var host3 = Configuration["host3"];
10+
11+
var theHost = HttpContext.Request.Host.Value;
12+
13+
14+
if (!host3.Contains(theHost) && !theHost.Contains("localhost"))
15+
{
16+
<text>Test from <a href="@host3">@host3</a> or
17+
<a href="https://localhost:5001">https://localhost:5001</a>
18+
</text>
19+
}
20+
}
21+
</div>
22+
23+
<div>
24+
<span id='result'></span>
25+
</div>
26+
27+
<ul>
28+
<li>
29+
<input type="button" value="Values"
30+
onclick="MyTestCors3( '@Model.Host','/api/values', 'GET')" />
31+
</li>
32+
33+
<li>
34+
<input type="button" value="PUT test"
35+
onclick="MyTestCors3( '@Model.Host', '/api/values/5', 'PUT')" />
36+
</li>
37+
38+
<li>
39+
<input type="button" value="GetValues2 [DisableCors]"
40+
onclick="MyTestCors3( '@Model.Host','/api/values/GetValues2', 'GET')" />
41+
</li>
42+
</ul>
43+
44+
<script src="~/js/MyJS.js"></script>
45+

0 commit comments

Comments
 (0)